cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201.exe
Size 251KB
Sample240511-cbm9mshd42
SHA256 cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201
MD5 abf939bc3a20a604f88b1dd4399ca2d7
SHA1 c656a5989a07d9b104c1eb144d4609d50264bee4
SHA512 a623060911ddd9fd4ecd8725a9ef6324f391a46fd800fb425b3b2fe7f3affe9c8bfabb6f5b9b9b55aff49cdc24f610530889ba159014dd49974d1431b3797abd
SSDEEP 6144:PYa6dVy0sCLFy97dXRusmcsTA1A05WntAI00cSz4B:PYRnnLFojusmBqCue4B
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201.exe
unpack001/dovhbys.exe

File Explorer

cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201.exe

.exe 251KB
dovhbys.exe

.exe 202KB
rdzgbm.x

127KB

cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201
MD5 abf939bc3a20a604f88b1dd4399ca2d7
SHA1 c656a5989a07d9b104c1eb144d4609d50264bee4
SHA512 a623060911ddd9fd4ecd8725a9ef6324f391a46fd800fb425b3b2fe7f3affe9c8bfabb6f5b9b9b55aff49cdc24f610530889ba159014dd49974d1431b3797abd
SSDEEP 6144:PYa6dVy0sCLFy97dXRusmcsTA1A05WntAI00cSz4B:PYRnnLFojusmBqCue4B
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

dovhbys.exe

IMPHASH 8b7db21c7c785880525b1470f99985ee
SHA256 2e422f230bd4a88cc223995a131d6ce9316eea7087d84d059fc45a35af3ea26c
MD5 0bef3d69abb4fe0e2e175ce823b2aa55
SHA1 aef3193926ef341507fc931c1b375e19eb872bd3
SHA512 f49e671ed2e8d0e029a214ed0b80b88b2f671ef2d1fd4f49b5da2fa64dd2d4fe2e73f615734a2f5222a5c5627474c55f54dae2f90d9b95df3c08b55fea27fbf0
SSDEEP 3072:0TkPSL1oCO72F8SgdU7sJJKGG/oADbA9McY2/mq3+Ag0FujqgA0e38:0IPSLSU8PdU7o0GuHAyc9uAOli8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

imm32

ImmGetVirtualKey ImmNotifyIME ImmAssociateContextEx ImmGetCompositionFontA ImmGetDescriptionA

kernel32

CreateFileW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW VirtualAlloc SetConsoleDisplayMode CreateNamedPipeA EscapeCommFunction LoadModule VerLanguageNameW GetFileType AddConsoleAliasA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers CloseHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapAlloc GetNumberOfConsoleMouseButtons DosDateTimeToFileTime EnumTimeFormatsW GetCommandLineA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess TerminateProcess RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree WriteConsoleW

user32

SetWindowPlacement DrawStateW CreateDialogIndirectParamW GetComboBoxInfo SetClassLongW EndMenu

gdi32

ModifyWorldTransform CreateColorSpaceW CreateDIBSection CreateRectRgn ArcTo Chord

winspool.drv

AdvancedDocumentPropertiesA DeletePortW EnumPortsA AddPortExA ResetPrinterW EXTDEVICEMODE DocumentPropertySheets

mswsock

NPLoadNameSpaces rresvport SetServiceA GetAcceptExSockaddrs WSARecvEx inet_network

mapi32

ord190 ord65 ord26

oleaut32

VarI2FromUI2 VarDecMul VarBstrFromBool SafeArrayCreateVector VarDecInt

setupapi

SetupDiGetDeviceInstallParamsA SetupDiClassNameFromGuidA SetupDiDestroyClassImageList

advapi32

CryptAcquireContextW CryptReleaseContext CryptGenRandom

cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

dovhbys.exe

imm32

kernel32

user32

gdi32

winspool.drv

mswsock

mapi32

oleaut32

setupapi

advapi32

generic

rdzgbm.x